We currently run v6.4.10 for our FMG-VM and manage bigger customer's FortiGates(FGTs) totalling about 600 (soon to be 800+).
And one of them needs one VIP group (two VIPs) at all 500+ locations. We use policy packages for this customer to standardize their policies, which is almost the same at all locations.
But when I looked at the VIP object config under Policy&Objects->Object Configurations->Firewall Objects->Virtual IPs then hit "Create New->Virtual IP", I don't see a way to select a dynamic address object for the External IP and Mapped IP.
This means we need to create 500+ x 2 VIPs manually putting each IP, then worse, we need to create 500+ different policies and use "Installation Target" to be for one specific FGT.
Is there a better way to have just one policy for one VIP group for 500+ FGTs?
Or, can I use meta fields+CLI template to define those on Device DB side and somehow let the policy to refer to the VIP group name?
There should be a better way to do this, right?
Thanks,
Toshi
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
I mean you can't use address objects in a VIP config on the FortiGate so why would you be able to on the FMG?
Also you have to create unique entries already because each location likely requires a unique IP address for the VIP? So that's gonna be a lot of work anyway regardless of using objects or not.
There is a decent way of doing this though:
I mean you can't use address objects in a VIP config on the FortiGate so why would you be able to on the FMG?
Also you have to create unique entries already because each location likely requires a unique IP address for the VIP? So that's gonna be a lot of work anyway regardless of using objects or not.
There is a decent way of doing this though:
Created on 04-19-2023 05:56 PM Edited on 04-19-2023 05:57 PM
Ok, my screen on the laptop was too small and I didn't scroll down all the way to the bottom to see "Per-device Mapping" ON/Off sliding switch. So VIPs can be actually dynamic objects I can configure different IP per-device. I'll use this feature.
I was thinking the meta fields method would probably work using a CLI template to define VIP config in Device DB instead of an object in the Policy&Object. But it might at least confuse our techs and might cause conflict when someone who doesn't know about the CLI template tries to create a VIP in the object DB temporarily to test something at one of locations.
In any case, I now see what you're explaining.
Thanks,
Toshi
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.